CVE-2014-8987

2015-08-2415:59:01

CWE-79

mitre

web.nvd.nist.gov

cve-2014-8987

cross-site scripting

xss vulnerability

mantisbt

configuration report page

remote administrators

html injection

web script

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

49.9%

JSON

Cross-site scripting (XSS) vulnerability in the “set configuration” box in the Configuration Report page (adm_config_report.php) in MantisBT 1.2.13 through 1.2.17 allows remote administrators to inject arbitrary web script or HTML via the config_option parameter, a different vulnerability than CVE-2014-8986.

Affected configurations

Nvd

Node

mantisbtmantisbtMatch1.2.13

mantisbtmantisbtMatch1.2.14

mantisbtmantisbtMatch1.2.15

mantisbtmantisbtMatch1.2.16

mantisbtmantisbtMatch1.2.17

VendorProductVersionCPE
mantisbtmantisbt1.2.13cpe:2.3:a:mantisbt:mantisbt:1.2.13:*:*:*:*:*:*:*
mantisbtmantisbt1.2.14cpe:2.3:a:mantisbt:mantisbt:1.2.14:*:*:*:*:*:*:*
mantisbtmantisbt1.2.15cpe:2.3:a:mantisbt:mantisbt:1.2.15:*:*:*:*:*:*:*
mantisbtmantisbt1.2.16cpe:2.3:a:mantisbt:mantisbt:1.2.16:*:*:*:*:*:*:*
mantisbtmantisbt1.2.17cpe:2.3:a:mantisbt:mantisbt:1.2.17:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mantisbt	mantisbt	1.2.13	cpe:2.3:a:mantisbt:mantisbt:1.2.13:::::::*
mantisbt	mantisbt	1.2.14	cpe:2.3:a:mantisbt:mantisbt:1.2.14:::::::*
mantisbt	mantisbt	1.2.15	cpe:2.3:a:mantisbt:mantisbt:1.2.15:::::::*
mantisbt	mantisbt	1.2.16	cpe:2.3:a:mantisbt:mantisbt:1.2.16:::::::*
mantisbt	mantisbt	1.2.17	cpe:2.3:a:mantisbt:mantisbt:1.2.17:::::::*